Statistical trace-based methods for real-time traffic classification

Abstract

Apparatus and methods for real-time traffic classification based on off-line determined traffic classification rules are provided. Traces of real traffic are obtained and subjected to statistical analysis. The statistical analysis identifies the multidimensional domain space of characteristic traffic parameters. Classification rules associated with the identified domains are derived and provided to traffic classification points for real-time traffic classification. Traffic classification points, typically edge network nodes, sample packets in aggregate streams with a predetermined probability. Statistical information regarding the sampled flows is tracked in a table, the number of time a flow was sampled providing a probabilistic measure of the flow's duration before the flow terminates. The table entries, which predominantly track high bandwidth flows, are subjected to the classification rules for real-time classification of the sampled flows. Optionally, rules include an action to be taken in respect of flows having characteristics matching thereof. Advantages are derived from low overhead on-line real-time classification of high-bandwidth flows at low overheads before flow termination.

Description

FIELD OF THE INVENTION[0001]The invention relates to content delivery at the edge of communications networks, and in particular methods and apparatus providing real-time trace-based traffic classification.BACKGROUND OF THE INVENTION[0002]Traffic classification is important for many reasons in delivering content to customers at the edge of communications networks. For example, Quality of Service (QoS) requires the traffic to be segregated first in order to assign packets to particular Classes of Service (CoS). A network operator can provide a different level of service to each class as well as a pricing structure.[0003]Knowledge of traffic characteristics can help optimize the usage of the communications network infrastructure employed, and can help ensure a desired level of performance for applications / services important to the customers. The intention has always been that application requirements be considered in offering a level of service. Traditional methods of traffic detection...

AI Technical Summary

Benefits of technology

"The invention provides a system and method for real-time classification of network traffic flows. The system includes a packet sampling system, a packet inspection system, a flow information tracking system, and a packet classifier system. The system can classify traffic flows based on pre-determined rules trained offline on statistical traffic flow information. The system can be easily integrated into existing network infrastructure and can handle high-bandwidth flows with low overhead. The technical effects of the invention include improved network security, efficient network management, and improved data analysis for network research and development."

Problems solved by technology

Therefore known approaches to traffic classification are no longer valid as logical ports are undefined for peer-to-peer applications and / or logical ports may be dynamically allocated as needed such in the case of the standard File Transfer Protocol (FTP) and others.

Resource utilization alone is not always an adequate traffic characteristic differentiator as in many instances content conveyed to, and received from, multiple customers is aggregated at the managed edge and within the managed transport communications network.

Therefore deep packet inspection incurs high processing overheads and is subject to high costs.

Deep packet inspection also suffers from a complexity associated with the requirement of inspecting packet payloads at high line rates.

For certainty, deep packet inspection is not suited at all for typical high throughput communications network nodes deployed in current communications networks.

Deep packet inspection also suffers from a high maintenance overhead as the detection techniques rely on signatures, peer-to-peer applications, especially, are known for concealing their identities—a deep packet inspection detection signature that provides conclusive detection now may not work in the future, and another conclusive signature would have to be found and coded therein.

Images